...
Recommendation | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
EXP19-C | Medium | Probable | Yes | YesMedium | P8P12 | L2L1 |
Automated Detection
Tool | Version | Checker | Description | |||||||||||
| Astrée |
| compound-ifelse compound-loop | Fully checked | |||||||||||
| Axivion Bauhaus Suite |
| CertC-EXP19 | Fully implemented | |||||||||||
| Helix QAC |
| C2212 | ||||||||||||
| Klocwork |
| MISRA.IF.NO_COMPOUND MISRA.STMT.NO_COMPOUND | ||||||||||||
| LDRA tool suite |
| 11 S, 12 S, 428 S | Fully Implemented | |||||||||||
| Parasoft C/C++test |
| CERT_C-EXP19-a | The statement forming the body of a 'switch', 'while', 'do...while' or 'for' statement shall be a compound statement | |||||||||||
| PC-lint Plus |
| 9012 | Fully supported | |||||||||||
| Polyspace Bug Finder |
| MISRA CERT C: | 2012 Rule 15.6The body of an iteration-statement or a selection-statement shall be a compound statement | Rec. EXP19-C | Checks for iteration or selection statement body not enclosed in braces (rec. fully covered) | |||||||||
| PRQA QA-C | ||||||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | 2212 | PVS-Studio |
| V563, V628, V640, V705 | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RuleChecker |
| compound-ifelse compound-loop | Fully checked | |||||||||||
| Security Reviewer - Static Reviewer |
| C51 | Fully implemented | |||||||||||
| SonarQube C/C++ Plugin |
| S121 |
Related Vulnerabilities
CVE-2014-1266 was due, in large part, to failing to follow this recommendation. There is a spurious "goto fail" statement on line 631 of sslKeyExchange.c. This "goto" gets executed unconditionally, even though it is indented as if it were part of the preceding "if" statement. As a result, the call to sslRawVerify (which performs the actual signature verification) is rendered dead code. [ImperialViolet 2014]. If the body of the "if" statement had been enclosed in braces, then this defect likely would not have happened.
...